SecurID takes backseat in Windows Vista

Death of passwords postponed

Common Topics

It was cheered, specifically by employees of RSA Security, as the means to provide secure login to PCs running Windows Vista, finally dispensing with passwords and helping lock down enterprise networks.

Two years later, though, Microsoft has abandoned plans to provide native support for RSA's SecureID token-based authentication system in the delayed operating system, despite having worked on integration with RSA.

A Microsoft spokesman told The Register that companies like RSA must now write so-called credential providers that talk to Windows Vista and allow their security tokens and authentication technologies to work with the operating system.

"Most customers told Microsoft they do not view one-time passwords as strategic and are looking long term to smart cards as their preferred strong authentication mechanism," the spokesman said.

Microsoft was speaking after RSA chief executive Art Coviello was reported to have revealed Microsoft had devised its own architecture for third parties to use rather than providing native support for SecurID.

The Microsoft/RSA SecureID alliance was announced at the RSA Conference in 2004 with enthusiastic backing from Microsoft. The vision was to provide users with two-factor authentication access to PCs and to finally replace static passwords - the death of which Gates has been predicting for some time.

Gates, then a relative newbie to RSA events, brandished an RSA key fob on stage at the 2004 show in San Francisco, California, to enthusiastic applause from RSA employees. Microsoft's head of security Mike Nash, meanwhile, said that SecurID would allow customers to "more positively identify users before giving them access to systems and corporate resources."

RSA and SecurID, though, appear to have lost their favored status. Instead, RSA must now join other security providers to develop credential providers, which plug into the Windows Vista LogonUI. Coviello blamed problems Microsoft has had delivering Windows Vista, saying native support for SecurID would appear in later editions of the operating system. ®